A high-severity SQL injection vulnerability in the Ubiquiti UniFi OS Server enables low-privileged users to achieve unauthorized privilege escalation.

The vulnerability consists of a series of SQL injection flaws triggered via authenticated access. By injecting malicious SQL queries, an attacker with low-level privileges can manipulate database operations to gain administrative control over the system.

With a CVSS score of 8.8, this vulnerability poses a significant risk to the integrity and security of the entire UniFi OS environment. Privilege escalation allows an attacker to gain full control over the management platform, leading to potential data exfiltration, device reconfiguration, or complete system takeover.

Immediate Action: Apply the latest security patches provided by Ubiquiti to remediate the SQL injection flaws within the UniFi OS Server.

Proactive Monitoring: Enable detailed database query logging and review logs for suspicious patterns or syntax errors that indicate attempted SQL injection.

Compensating Controls: Implement strict database access controls and utilize a Web Application Firewall (WAF) to filter malicious SQL syntax from incoming requests.

Public Exploit Available: false

Given that this vulnerability allows for privilege escalation, it must be treated with high urgency. Administrators should audit user accounts for any unauthorized changes and apply the vendor patch immediately to neutralize the risk of full system compromise.